{"id":32128126,"url":"https://github.com/nexcess/puppet-auditd","last_synced_at":"2025-10-21T00:54:41.959Z","repository":{"id":14012370,"uuid":"75218324","full_name":"nexcess/puppet-auditd","owner":"nexcess","description":null,"archived":false,"fork":false,"pushed_at":"2025-02-19T18:43:30.000Z","size":53,"stargazers_count":1,"open_issues_count":0,"forks_count":8,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-10-21T00:54:39.079Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nexcess.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2016-11-30T19:12:04.000Z","updated_at":"2025-02-19T18:43:16.000Z","dependencies_parsed_at":"2023-09-26T00:40:00.907Z","dependency_job_id":null,"html_url":"https://github.com/nexcess/puppet-auditd","commit_stats":{"total_commits":17,"total_committers":3,"mean_commits":5.666666666666667,"dds":0.4117647058823529,"last_synced_commit":"8bfaf1474658fe7ef45d41ec98f90ac64100be81"},"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/nexcess/puppet-auditd","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nexcess%2Fpuppet-auditd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nexcess%2Fpuppet-auditd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nexcess%2Fpuppet-auditd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nexcess%2Fpuppet-auditd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nexcess","download_url":"https://codeload.github.com/nexcess/puppet-auditd/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nexcess%2Fpuppet-auditd/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280184449,"owners_count":26286833,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-20T02:00:06.978Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-21T00:54:36.829Z","updated_at":"2025-10-21T00:54:41.940Z","avatar_url":"https://github.com/nexcess.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# auditd\n\n#### Table of Contents\n\n1. [Module Description ](#module-description)\n2. [Usage - Configuration options and additional functionality](#usage)\n3. [Audispd](#audispd)\n4. [Reference ](#reference)\n5. [Limitations](#limitations)\n6. [Copyright](#copyright)\n\n## Module Description\n\nThis module installs, and configures the auditd service and ruleset.  The currently supported platforms are:\n\n  - RHEL 6/7\n  - CentOS 6/7\n  - Rocky Linux 9\n  - Ubuntu 24.04\n\nBy default, the only rules that are applied are the buffer size, and action to take on failure.\n\n## Usage\n\n### Installing and starting\n\n~~~puppet\ninclude ::auditd\n~~~\n\n### Specifying Rules\n\nRules can be specified via four parameters:\n\n1. auditd::base_rules\n2. auditd::main_rules\n3. auditd::server_rules\n4. auditd::finalize_rules\n\nEach location takes a yaml list of rules like so:\n\n~~~yaml\nauditd::main_rules:\n  - '-a always,exit -F path=/etc/passwd -F perm=wa -F key=accounts'\n  - '-a always,exit -F path=/etc/gshadow -F perm=wa -F key=accounts'\n~~~\n\nThe purpose of each location is as follows:\n\n  - auditd::base_rules is loaded *before* any other rules are processed\n  - auditd::main_rules is the primary set of rules to use\n  - auditd::server_rules are any rules specific to a given node, that should load *after* the primary rules\n  - auditd::finalize_rules are any rules that should load after all other rules. The common use for this is to lock the rules from changing without a reboot.\n\n### Note about `augenrules`\n\nCurrently, this module depends on the `auditctl` and `augenrules` binaries to load rules.  While there is a parameter to not use `augenrules`, there currently isn't any alternative that is tried.\n\n### Note about service restarts\n\nDue to some implementations of auditd not being able to be fully restarted, configuration changes for the service its self trigger a service reload.  Because Puppet doesn't provide an easy way to trigger service reloads instead of restarts, this is handled by a case statement and exec.  Currently, the following service providers *should* work when sepecified:\n\n  - redhat\n  - systemd\n\nAdditional service providers may be added in the future.\n\n## Audispd\n\nThis module also allows for some basic audispd (audit event multiplexor) configuration.\n\n### Usage\n\nBy default, this module will attempt to manage a file at `/etc/audisp/audispd.conf`, and install additional audispd plugins.  You can prevent management of audispd by setting the `auditd::audisp::manage` parameter to `false`.\n\n### Plugins\n\n`auditd::audisp::plugin` is a resource type which can be used to create plugin configuration files.  If the `auditd::audisp::plugins` parameter is not empty, this module will attempt to create a configuration file for the plugin(s) specified in the parameter.\n\n## Reference\n\n### Classes\n\n#### Public Classes\n\n* auditd: Main class, includes all other classes.\n* auditd::audisp::plugins: Class to set up specified audispd plugins.\n\n#### Private Classes\n\n* auditd::install: Handles package installation.\n* auditd::config: Handles auditd configuration.\n* auditd::rules: Handles auditd rules.\n* auditd::service: Handles auditd service and rule loading.\n* auditd::audisp: Handles management of audispd\n* auditd::audisp::install: Handles installation of audispd plugins\n* auditd::audisp::config: Handles configuration of audispd\n\n### Types\n\n#### `auditd::audisp::plugin`\n\nThis type creates a configuration file for a audispd plugin.  It accepts the following parameters:\n\n  * 'active' - Whether or not the plugin should be activated. Valid options: Boolean. Default value: true\n  * 'direction' - Which direction events flow to the plugin. Valid options: 'in' or 'out'. Default value: 'out'\n  * 'path' - The absolute path to the plugin executable. Valid options: String . Default value: undef\n  * 'type' - How the plugin wants to run. Valid options: 'builtin' or 'always'. Default value: 'always'\n  * 'args' - Maximum of 2 arguments to pass to the child program. Valid options: Array containing strings. Default value: []\n  * 'format' - The format to send events as. Valid options: 'binary' or 'string'. Default value: 'string'\n\nIt uses the title of the resource to create a file called \"${title}.conf\", under the directory specified in [`auditd::audisp::plugindir`](#audit::audisp::plugindir).\n\n### Parameters\n\nThe below parameters are available in the `::auditd` class.  The man page for auditd.conf can be referenced for more detailed description of each option.\n\n#### `auditd::conf`\n\nThe fullpath of the main auditd configuration file. Valid options: string containing fullpath. Default value: '/etc/audit/auditd.conf'\n\n#### `auditd::log_file`\n\nThe file to use for audit logging. Valid options: string containing fullpath. Default value: '/var/log/audit/audit.log'\n\n#### `auditd::log_format`\n\nThe log format describes how the information should be stored on disk. Valid options: string containing log format. Default value: 'RAW'\n\n#### `auditd::log_group`\n\nThe group that is applied to the log file's permissions. Valid options: string containing group. Default value: 'root'\n\n#### `auditd::priority_boost`\n\nTells the audit daemon how much of a priority boost it should take. Valid options: 0 or positive integer. Default value: 4\n\n#### `auditd::flush`\n\nTells the audit daemon how to handle flushing audit records to disk. Valid options: string containing flush method. Default value: 'INCREMENTAL'\n\n#### `auditd::freq`\n\nConfigures how often an explicit flush to disk is issued. Valid options: positive ingeger. Default value: 20\n\n#### `auditd::num_logs`\n\nThe number of log files to keep if rotate is given as the max_log_file_action. Valid options: integer between 0 and 99. Default value: 5\n\n#### `auditd::disp_qos`\n\nControls whether you want blocking/lossless or non-blocking/lossy communication between the audit daemon and the dispatcher. Valid options: string containing communication type. Default value: 'lossy'\n\n#### `auditd::dispatcher`\n\nApplication that all events are passed to. Valid options: string containing the path to a program. Default value: '/sbin/audispd'\n\n#### `auditd::name_format`\n\nHow node names are inserted into event stream. Valid options: string containing the node name format. Default value: 'NONE'\n\n#### `auditd::admin_name`\n\nMachine name if `auditd::name_format` is set to `user`. Valid options: string containing the machine name. Default value: undef\n\n#### `auditd::max_log_file`\n\nMaximum log file size in MB. Valid options: positive numeric. Default value: 6\n\n#### `auditd::max_log_file_action`\n\nAction to take when `auditd::max_log_file` size is reached. Valid options: string containing action to take. Default value: 'ROTATE'\n\n#### `auditd::space_left`\n\nWhen the machine reaches `auditd::space_left` diskspace (in MB) remaining, take an action. Valid options: positive numeric. Default value: 75\n\n#### `auditd::space_left_action`\n\nAction to take when the auditd daemon detects low disk space. Valid options: string containing the action to take. Default value: 'SYSLOG'\n\n#### `auditd::action_mail_acct`\n\nEmail alert is sent to when `auditd::space_left_action` is set to 'email'. Valid options: string containing email. Default value: 'root'\n\n#### `auditd::admin_space_left`\n\n'Last chance' threshold in MB to take action when machine is low on disk space. Valid options: positive numeric. Default value: 50\n\n#### `auditd::admin_space_left_action`\n\nSee `auditd::space_left_action`.\n\n#### `auditd::disk_full_action`\n\nAction to take when partition used for logs is full. Valid options: string containing action. Default value: 'SUSPEND'\n\n#### `auditd::disk_error_action`\n\nAction to take when disk error is occured when writing or rotating logs. Valid options: string containing action. Default value: 'SUSPEND'\n\n#### `auditd::tcp_listen_port`\n\nTCP port to listen for events from other machines on. Valid options: integer between 1 and 65535. Default value: undef\n\n#### `auditd::tcp_listen_queue`\n\nHow many pending connections to allow. Valid options: positive integer. Default value: 5\n\n#### `auditd::tcp_max_per_addr`\n\nHow many connections per-host are allowed. Valid options: integer between 1 and 1024. Default value: 1\n\n#### `auditd::use_libwrap`\n\nWhether or not to use tcp_wrappers to restrict connections. Valid options: boolean. Default value: true\n\n#### `auditd::tcp_client_ports`\n\nSpecifies which incoming ports are allowed for client connections. Valid options: integer between 1 and 65535, or two integers seperated with a '-'. Default value: undef\n\n#### `auditd::tcp_client_max_idle`\n\nNumber of seconds a client is allowed to remain idle. Valid options: positive integer. Default value: 0\n\n#### `auditd::enable_krb5`\n\nIf enabled, Kerberos 5 will be used for authentication. Valid options: boolean. Default value: false\n\n#### `auditd::krb5_principal`\n\nThe principal for the server. Valid options: string containing the principal. Default value: 'auditd'\n\n#### `auditd::krb5_key_file`\n\nThe key for the server's principal. Valid options: string containing path to key. Default value: undef\n\n#### `auditd::service_manage`\n\nWhether to manage the service with this module. Valid options: boolean. Default value: true\n\n#### `auditd::service_enable`\n\nWhether to enable the the service on system start. Valid options: boolean. Default value: true\n\n#### `auditd::service_name`\n\nThe name of the auditd serivce. Valid options: string containing the service name. Default value: 'auditd'\n\n#### `auditd::service_provider`\n\nThe service provider that would normally be used with the service type. Valid options: string containing the service provider. Default value: 'systemd'\n\nNote that this is normally determined automatically by Puppet. Due to how service reloads are managed, we have to manually specify it to trigger a service reload instead of a restart.\n\n#### `auditd::manage_package`\n\nWhether to manage the package with this module. Valid options: boolean. Default value: true\n\n#### `auditd::package_name`\n\nName of the auditd package. Valid options: string containing package name. Default value: 'audit'\n\n#### `auditd::package_state`\n\nState to use for package type. Valid options: string containing package state. Default value: 'present'\n\n#### `auditd::use_augenrules`\n\nWhether to use `augenrules` format for rule creation (i.g. 'rules.d' format; not monolithic file). Valid options: boolean. Default value: true\n\nNote, that currently if set to `false`, then no rules will be applied or loaded by the module.\n\n#### `auditd::rulesd_dir`\n\nDirectory to use for 'rules.d' format. Valid options: string containing path to directory. Default value: '/etc/audit/rules.d'\n\n#### `auditd::purge_rules`\n\nWhether to remove any files Puppet doesn't manage from the directory specified by `auditd::rulesd_dir`. Valid options: boolean. Default value: true\n\n#### `auditd::rules_buffer_size`\n\n\n#### `auditd::rules_failure_mode`\n\n\n#### `auditd::base_rules`\n\nRules to load before any other, after the buffer and failure options. Valid options: list containing strings of rules. Default value: undef\n\n#### `auditd::main_rules`\n\nRules to be loaded as the 'core' set. Valid options: list containing strings of rules. Default value: undef\n\n#### `auditd::server_rules`\n\nRules to be loaded after the main rules, to be used for node-specific configuration. Valid options: list containing strings of rules. Default value: undef\n\n#### `auditd::finalize_rules`\n\nRules to be loaded after any other rule specified. Mainly used if you wanted to lock rules from changing without a reboot. Valid options: list containing strings of rules. Default value: undef\n\n#### `auditd::audisp::manage`\n\nWhether to manage audispd with this module or not. Valid options: Boolean. Default value: true\n\n#### `auditd::audisp::audispd_conf`\n\nThe configuration file to use for audispd. Vaild options: String. Default value: '/etc/audisp/audispd.conf'\n\n#### `auditd::audisp::plugindir`\n\nThe path to the 'plugins.d' directory for audispd. Valid options: String. Default value: '/etc/audisp/plugins.d'\n\n#### `auditd::audisp::q_depth`\n\nHow large the internal queue should be for audispd. Valid options: Numeric. Default value: 80\n\n#### `auditd::audisp::overflow_action`\n\nHow audispd should react when its internal queue overflows. Valid options: String. Default value: 'syslog'\n\n#### `auditd::audisp::audispd_priority_boost`\n\nHow much of a priority boost audispd should have. Valid options: Postitive Integer. Default value: 4\n\n#### `auditd::audisp::max_restarts`\n\nHow many attempts audispd will make to restart crashed plugins. Valid options: Positive Integer. Default value: 10\n\n#### `auditd::audisp::audispd_name_format`\n\nHow node names are inserted into event stream. Valid options: String. Default value: hostname\n\n#### `auditd::audisp::audispd_name`\n\nString identifying the machine when using the 'user' name_format. Valid options: String. Default value: undef\n\n#### `auditd::audisp::install_plugins`\n\nWhether to install additional audispd plugins. Valid options: Boolean. Default value: true\n\n#### `auditd::audisp::plugin_package_name`\n\nThe name of the package containing the audispd plugins. Valid options: String. Default value: 'audispd-plugins'\n\n#### `auditd::audisp::plugins`\n\nA list of plugins to configure on a server. Vaild options: Hash of plugins and parameters. Default value: undef\n\n## Limitations\n\nCurrently the module is only really useful on systems that have `augenrules` and use the rules.d directory.  While the option is there to disable augenrules, there currently isn't any alternative method implemented.\n\n## Copyright\n\n~~~\n   Copyright 2016 Nexcess.net\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n~~~\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnexcess%2Fpuppet-auditd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnexcess%2Fpuppet-auditd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnexcess%2Fpuppet-auditd/lists"}